3 ms·

I think it's clear that the fewer plugins one installs (ideally none) the better, though it's difficult to follow this rule in practice. I recently had to set u

by theden 5y ago

I think it's clear that the fewer plugins one installs (ideally none) the better, though it's difficult to follow this rule in practice. I recently had to set up a WP website from scratch, and plugins are a very common way for people to solve their problems (especially non-technical users). Plugins are even used for basic ops work like rewrite rules, backups, log parsing, caching—and I get it, for most people if they didn't exist they wouldn't have done the ops stuff, or solve many of the other types of problems, so it's kind of a blessing and a curse given your attack surface increases with each plugin and WP feature. I've learned that Wordpress really is what you make of it, directly proportional to the engineering effort you put in.

edgyquant 5y ago
I don’t think is really at all clear. Whether it’s word press plugins, or a few thousand JS or Python modules you install with npm/pip, the market has moved into this direction because it is the most efficient. The problem is 100% in testing which is something most places slack of at because people joining, if they do write tests at all, only test their additions to the codebase. It isn’t just Wordpress, either, I think that testing of large scale interconnected software is not yet a solved problem and whomever can devise a system that eliminates all the vulnerability types we’ve seen exploited over the last few years will become very rich.
- harikb 5y ago
  Testing, while required, is an orthogonal problem. I haven’t seen a “test” in any ecosystem that can detect a malware
  - MeinBlutIstBlau 5y ago
  - edgyquant 5y ago
    Yeah exactly, that’s my point. We haven’t been developing and using a ton of test types we could realistically do now given the proper incentives. At some point, with more and more data being accumulated and more and more services being brought online, we will have to start adding more foolproof tests suites as it it’s reaching a point where it’s not just company reputation but national security that we’re risking.
  - onion2k 5y ago
    You don't test for malware. You test to make sure the attack vector that's used to install malware is closed to attackers. For example, if you have an upload feature your tests should check that your file type filtering actually works, that things in your upload directory aren't executable, that you can't upload to the path of an existing file, and so on. You should build with security in mind, and test that the code you wrote does what you think it should do, and that it doesn't do things it shouldn't do.
- IncRnd 5y ago
  > I think that testing of large scale interconnected software... That's not the issue with WordPress plugins, which generally suffer from unknown provenance and suspect security-posture.

by theden 5y ago

edgyquant 5y ago

I don’t think is really at all clear. Whether it’s word press plugins, or a few thousand JS or Python modules you install with npm/pip, the market has moved into this direction because it is the most efficient. The problem is 100% in testing which is something most places slack of at because people joining, if they do write tests at all, only test their additions to the codebase. It isn’t just Wordpress, either, I think that testing of large scale interconnected software is not yet a solved problem and whomever can devise a system that eliminates all the vulnerability types we’ve seen exploited over the last few years will become very rich.

harikb 5y ago
Testing, while required, is an orthogonal problem. I haven’t seen a “test” in any ecosystem that can detect a malware
- MeinBlutIstBlau 5y ago
- edgyquant 5y ago
  Yeah exactly, that’s my point. We haven’t been developing and using a ton of test types we could realistically do now given the proper incentives. At some point, with more and more data being accumulated and more and more services being brought online, we will have to start adding more foolproof tests suites as it it’s reaching a point where it’s not just company reputation but national security that we’re risking.
- onion2k 5y ago
  You don't test for malware. You test to make sure the attack vector that's used to install malware is closed to attackers. For example, if you have an upload feature your tests should check that your file type filtering actually works, that things in your upload directory aren't executable, that you can't upload to the path of an existing file, and so on. You should build with security in mind, and test that the code you wrote does what you think it should do, and that it doesn't do things it shouldn't do.
IncRnd 5y ago
> I think that testing of large scale interconnected software... That's not the issue with WordPress plugins, which generally suffer from unknown provenance and suspect security-posture.